spoolss: clear info on GetPrintProcessorDirectory error

If an error is returned without zeroing a pre-allocated @info pointer,
then marshalling of the response will fail.

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10984

Signed-off-by: David Disseldorp <ddiss@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c
index 9b898d0ab539a3aafe0481b91e7756c9bd25e3be..c8c670b1123afc563bf8ca76d84ae0cdd53d08f7 100644 (file)
--- a/source3/rpc_server/spoolss/srv_spoolss_nt.c
+++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c
@@ -10146,7 +10146,8 @@ WERROR _spoolss_GetPrintProcessorDirectory(struct pipes_struct *p,
        /* that's an [in out] buffer */
 
        if (!r->in.buffer && (r->in.offered != 0)) {
-               return WERR_INVALID_PARAM;
+               result = WERR_INVALID_PARAM;
+               goto err_info_free;
        }
 
        DEBUG(5,("_spoolss_GetPrintProcessorDirectory: level %d\n",
@@ -10162,7 +10163,8 @@ WERROR _spoolss_GetPrintProcessorDirectory(struct pipes_struct *p,
 
        snum = find_service(talloc_tos(), "prnproc$", &prnproc_share);
        if (!prnproc_share) {
-               return WERR_NOMEM;
+               result = WERR_NOMEM;
+               goto err_info_free;
        }
        if (snum != -1) {
                prnproc_share_exists = true;
@@ -10173,8 +10175,7 @@ WERROR _spoolss_GetPrintProcessorDirectory(struct pipes_struct *p,
                                                    r->in.environment,
                                                    &r->out.info->info1);
        if (!W_ERROR_IS_OK(result)) {
-               TALLOC_FREE(r->out.info);
-               return result;
+               goto err_info_free;
        }
 
        *r->out.needed  = SPOOLSS_BUFFER_UNION(spoolss_PrintProcessorDirectoryInfo,
@@ -10182,6 +10183,10 @@ WERROR _spoolss_GetPrintProcessorDirectory(struct pipes_struct *p,
        r->out.info     = SPOOLSS_BUFFER_OK(r->out.info, NULL);
 
        return SPOOLSS_BUFFER_OK(WERR_OK, WERR_INSUFFICIENT_BUFFER);
+
+err_info_free:
+       TALLOC_FREE(r->out.info);
+       return result;
 }
 
 /*******************************************************************